Spencer Duncan

A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.

IT Worker Fraud First reported 2026-09-21

Identifiers attributed to this persona

6 indicators the sources below record for this operator, each with its sources.

IndicatorTypeAccount status
Spencer Duncan alias —
spencerduncanpower@gmail.com email address —
timdonerpower@gmail.com email address —
https://github.com/everythinguwannatobe github profile live checked 2026-09-30
https://github.com/spencerduncanpower github profile live checked 2026-09-30
+13522344952 phone number —

Spencer Duncan

alias IT Worker Fraud CURATED

First seen 2026-09-21 · last seen 2026-09-21

Sources

  • Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used.
    docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document · under “Spencer Duncan” · pulled 2026-09-09
  • Read on 21 September 2026 by walking the commit history of every repository on github.com/everythinguwannatobe, an account reached because its Next.js_swap repository is byte for byte the one the account filed under ZEUS holds. The ZEUS-DEV-919 working document, from which this persona is transcribed, gives one address for Spencer Duncan, timdonerpower@gmail.com, and this account signs 1,948 commits with it, under the names TimDoner, spencerduncanpower and its own login. A second address, spencerduncanpower@gmail.com, signs 702 more under the account's own login and is recorded here as the same holder's: it is the persona's name as a mailbox, used on the same account beside the address the document published. github.com/spencerduncanpower also exists as an account, created on 3 March 2023 with no public repositories, and a third login, nicholasduncanpower, is attributed two commits in these repositories. The account was created on 29 October 2022, holds 57 repositories of which 17 were created on 30 October 2023, and its profile reads Senior Software Engineer under the display name BE THE BEST BEST!. Its Next.js_swap was created on 29 October 2022 with 13 commits signed TimDoner; the ZEUS account's copy was created on 16 January 2023 and its oldest commit is dated 1 December 2022, so the code moved from this persona to that one. Two personas holding one another's code is recorded as a link between the entries, not as one hand.
    github.com/everythinguwannatobe — Chollima Hunter · under “Spencer Duncan” · pulled 2026-09-21

spencerduncanpower@gmail.com

email address IT Worker Fraud CURATED

First seen 2026-09-21 · last seen 2026-09-21

Source

  • Read on 21 September 2026 by walking the commit history of every repository on github.com/everythinguwannatobe, an account reached because its Next.js_swap repository is byte for byte the one the account filed under ZEUS holds. The ZEUS-DEV-919 working document, from which this persona is transcribed, gives one address for Spencer Duncan, timdonerpower@gmail.com, and this account signs 1,948 commits with it, under the names TimDoner, spencerduncanpower and its own login. A second address, spencerduncanpower@gmail.com, signs 702 more under the account's own login and is recorded here as the same holder's: it is the persona's name as a mailbox, used on the same account beside the address the document published. github.com/spencerduncanpower also exists as an account, created on 3 March 2023 with no public repositories, and a third login, nicholasduncanpower, is attributed two commits in these repositories. The account was created on 29 October 2022, holds 57 repositories of which 17 were created on 30 October 2023, and its profile reads Senior Software Engineer under the display name BE THE BEST BEST!. Its Next.js_swap was created on 29 October 2022 with 13 commits signed TimDoner; the ZEUS account's copy was created on 16 January 2023 and its oldest commit is dated 1 December 2022, so the code moved from this persona to that one. Two personas holding one another's code is recorded as a link between the entries, not as one hand.
    github.com/everythinguwannatobe — Chollima Hunter · under “Spencer Duncan” · pulled 2026-09-21

timdonerpower@gmail.com

email address IT Worker Fraud CURATED

First seen 2026-09-21 · last seen 2026-09-21

Sources

  • Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used.
    docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document · under “Spencer Duncan” · pulled 2026-09-09
  • Read on 21 September 2026 by walking the commit history of every repository on github.com/everythinguwannatobe, an account reached because its Next.js_swap repository is byte for byte the one the account filed under ZEUS holds. The ZEUS-DEV-919 working document, from which this persona is transcribed, gives one address for Spencer Duncan, timdonerpower@gmail.com, and this account signs 1,948 commits with it, under the names TimDoner, spencerduncanpower and its own login. A second address, spencerduncanpower@gmail.com, signs 702 more under the account's own login and is recorded here as the same holder's: it is the persona's name as a mailbox, used on the same account beside the address the document published. github.com/spencerduncanpower also exists as an account, created on 3 March 2023 with no public repositories, and a third login, nicholasduncanpower, is attributed two commits in these repositories. The account was created on 29 October 2022, holds 57 repositories of which 17 were created on 30 October 2023, and its profile reads Senior Software Engineer under the display name BE THE BEST BEST!. Its Next.js_swap was created on 29 October 2022 with 13 commits signed TimDoner; the ZEUS account's copy was created on 16 January 2023 and its oldest commit is dated 1 December 2022, so the code moved from this persona to that one. Two personas holding one another's code is recorded as a link between the entries, not as one hand.
    github.com/everythinguwannatobe — Chollima Hunter · under “Spencer Duncan” · pulled 2026-09-21

https://github.com/everythinguwannatobe

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2026-09-21 · last seen 2026-09-21

Source

  • Read on 21 September 2026 by walking the commit history of every repository on github.com/everythinguwannatobe, an account reached because its Next.js_swap repository is byte for byte the one the account filed under ZEUS holds. The ZEUS-DEV-919 working document, from which this persona is transcribed, gives one address for Spencer Duncan, timdonerpower@gmail.com, and this account signs 1,948 commits with it, under the names TimDoner, spencerduncanpower and its own login. A second address, spencerduncanpower@gmail.com, signs 702 more under the account's own login and is recorded here as the same holder's: it is the persona's name as a mailbox, used on the same account beside the address the document published. github.com/spencerduncanpower also exists as an account, created on 3 March 2023 with no public repositories, and a third login, nicholasduncanpower, is attributed two commits in these repositories. The account was created on 29 October 2022, holds 57 repositories of which 17 were created on 30 October 2023, and its profile reads Senior Software Engineer under the display name BE THE BEST BEST!. Its Next.js_swap was created on 29 October 2022 with 13 commits signed TimDoner; the ZEUS account's copy was created on 16 January 2023 and its oldest commit is dated 1 December 2022, so the code moved from this persona to that one. Two personas holding one another's code is recorded as a link between the entries, not as one hand.
    github.com/everythinguwannatobe — Chollima Hunter · under “Spencer Duncan” · pulled 2026-09-21

https://github.com/spencerduncanpower

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2026-09-21 · last seen 2026-09-21

Source

  • Read on 21 September 2026 by walking the commit history of every repository on github.com/everythinguwannatobe, an account reached because its Next.js_swap repository is byte for byte the one the account filed under ZEUS holds. The ZEUS-DEV-919 working document, from which this persona is transcribed, gives one address for Spencer Duncan, timdonerpower@gmail.com, and this account signs 1,948 commits with it, under the names TimDoner, spencerduncanpower and its own login. A second address, spencerduncanpower@gmail.com, signs 702 more under the account's own login and is recorded here as the same holder's: it is the persona's name as a mailbox, used on the same account beside the address the document published. github.com/spencerduncanpower also exists as an account, created on 3 March 2023 with no public repositories, and a third login, nicholasduncanpower, is attributed two commits in these repositories. The account was created on 29 October 2022, holds 57 repositories of which 17 were created on 30 October 2023, and its profile reads Senior Software Engineer under the display name BE THE BEST BEST!. Its Next.js_swap was created on 29 October 2022 with 13 commits signed TimDoner; the ZEUS account's copy was created on 16 January 2023 and its oldest commit is dated 1 December 2022, so the code moved from this persona to that one. Two personas holding one another's code is recorded as a link between the entries, not as one hand.
    github.com/spencerduncanpower — Chollima Hunter · under “Spencer Duncan” · pulled 2026-09-21

+13522344952

phone number IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Line type

Line typeVoIP
CarrierSKYPE P2P
Block carrierNEW CINGULAR WIRELESS PCS, LLC - GA
Rate centreMICANOPY, FL

phonevalidator.com labels the line LANDLINE while naming Skype P2p as the carrier in the same row. The carrier is an interconnected VoIP provider, which is what the classification here follows.

Looked up 2026-09-12 at phonevalidator.com and localcallingguide.com. This is a lookup of the line itself. A VoIP line is not evidence on its own.

Source

  • Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used.
    docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document · under “Spencer Duncan” · pulled 2026-09-09

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Spencer Duncan as the name of the operator is the cited researcher’s assertion, repeated here as their claim.